affect-cli 0.0.3 → 0.0.5

package/README.md

@@ -1,6 +1,6 @@
 # affect-cli
 
-Shared environment and deployment commands for [Affect](https://github.com/ludicroushq/affect). Requires Bun 1.4.2 or later and a project-local Convex CLI.
+Shared environment and deployment commands for Affect projects. Requires Bun 1.4.2 or later and a project-local Convex CLI.
 
 ```sh
 bun add --dev --exact affect-cli
@@ -10,23 +10,36 @@ bunx --no-install affect --help
 Run commands from the application repository root:
 
 - `affect env` prints shell exports from `env/{development,preview,production,ci}/.env`. It requires the matching `DOTENV_PRIVATE_KEY` when that file exists. Treat its output as secrets.
+- `affect env sync-dev [--force]` reads only `env/development/.env` with its matching `DOTENV_PRIVATE_KEY` and synchronizes declared server settings to its verified hosted development backend. The profile must provide the canonical `VITE_CONVEX_URL` and `VITE_CONVEX_SITE_URL` pair and a development-scoped deploy key. It never deploys code or builds the frontend. It ignores inherited CI, production, account-token and provider-host selection. Missing required settings fail; absent optional settings preserve remote values; explicit empty strings remain values. Existing differing values refuse the entire batch unless `--force` is supplied. Omission never deletes a remote setting. Output contains only the verified target and setting counts.
 - `affect run -- <command> [args...]` loads that environment and runs a command. Existing environment values take precedence; arguments, standard I/O, and exit codes are preserved.
 - `affect dotenvx -- …` forwards arguments to the bundled native dotenvx CLI, for example `affect dotenvx -- encrypt -f env/development/.env --no-armor --no-native`.
 - `affect setup` initializes an anonymous local Convex backend only for a fresh project, or retries its environment import. It preserves existing linked deployments and credentials.
-- `affect deploy` uses Convex's native deploy/build sequence, imports the selected backend environment, and builds the frontend. Vercel supplies `VERCEL_ENV=preview|production` and the preview branch name automatically; put the matching deploy key in the encrypted file. `--build` is its internal Convex callback.
+- `affect deploy` invokes Convex's native deploy sequence for the selected Vercel-scoped profile. Native `convex deploy` pushes Convex backend code and runs the root build callback; Vercel supplies `VERCEL_ENV=preview|production` and the preview branch name automatically, and the matching deploy key remains encrypted in the profile. The callback requires the verified `VITE_CONVEX_URL` and `VITE_CONVEX_SITE_URL` pair and runs the root TanStack build. Frontend build output is not published by `affect deploy`; publication belongs to the configured frontend host. `--build` is its internal Convex callback.
 
-Selection uses `VERCEL_ENV`, then `ci` for GitHub Actions/CI, otherwise `development`. Files stay in the application; cryptography stays in dotenvx. Deployment follows Affect's `apps/web` layout.
+Except for the explicitly development-only `env sync-dev`, selection uses `VERCEL_ENV`, then `ci` for GitHub Actions/CI, otherwise `development`. Files stay in the application; cryptography stays in dotenvx. Deployment follows Affect's `apps/web` layout.
 
-For example, an application's package scripts can load their environment automatically:
+`env sync-dev` requires a declaration-only `convex/env.config.ts` with a default Convex `EnvDefinition` export. Share that same object with `defineApp({ env })`; keep it independent of generated files, app/component initialization and runtime environment reads. The Bun-only CLI loads this trusted module directly. It does not execute `convex.config.ts` or generate an allowlist from source text. For example:
 
-```json
-{
-  "scripts": {
-    "dev": "affect run -- convex dev --start \"bun run dev:web\""
-  }
-}
+```ts
+import type { EnvDefinition } from "convex/server";
+import { v } from "convex/values";
+
+export default {
+  API_TOKEN: v.string(),
+  OPTIONAL_SETTING: v.optional(v.string()),
+} satisfies EnvDefinition;
 ```
 
+Use the profile's development-scoped deploy key and canonical public Convex cloud/site origins (`VITE_CONVEX_URL` and `VITE_CONVEX_SITE_URL`). Before any update the command verifies the provider's cloud/development identity, owning team/project and both canonical URLs. Reserved credential/control/client-public names are rejected even if declared. Only present declared server settings are sent, using the native Convex JSON environment API without temporary plaintext files; native Convex remains responsible for provider limits and application value validation. The command needs metadata and environment read/write permissions; it does not create credentials or fall back to a broader login. Profile values use the same dotenvx decryption and interpolation as `affect env`. The profile remains encrypted with dotenvx; only settings declared by `convex/env.config.ts` cross into the backend.
+
+From the application root, run the TanStack development script with the selected profile:
+
+```sh
+bunx --no-install affect run -- bun run dev
+```
+
+`affect run` supplies the selected profile to the application process; it does not start a Convex watcher. The canonical Convex URLs are Vite build-time values. A host may separately provide runtime-only listener settings for its server, but `affect deploy` does not create a runtime env file or copy the deploy key into the frontend. Vercel supplies `VERCEL_ENV` and, for previews, `VERCEL_GIT_COMMIT_REF`; the CLI uses those host values to select the target and branch, then reads the matching deploy key from the encrypted profile.
+
 ## Development and releases
 
 ```sh
@@ -37,4 +50,4 @@ bun run changeset version
 bun run release
 ```
 
-For automated releases, commit a changeset with each releasable change. The release workflow opens a version PR; merging it publishes to npm. Configure npm's GitHub trusted publisher for `ludicroushq/affect-cli`, workflow `release.yml`, with direct publishing enabled. No npm token is needed. `bun run release` remains available for an intentional manual release.
+For automated releases, commit a changeset with each releasable change. The release workflow opens a version PR; merging it publishes to npm. Configure npm's GitHub trusted publisher for `nahtnam/affect-cli`, workflow `release.yml`, with direct publishing enabled. No npm token is needed. `bun run release` remains available for an intentional manual release.

package/dist/index.js

@@ -1684,6 +1684,7 @@ var normalize = (n) => n > 0 ? Math.floor(n) : 0;
 // node_modules/effect/dist/Result.js
 var succeed2 = succeed;
 var fail2 = fail;
+var failVoid = /* @__PURE__ */ fail2(undefined);
 var try_ = (evaluate) => {
   if (isFunction(evaluate)) {
     try {
@@ -1841,6 +1842,17 @@ var contains = /* @__PURE__ */ containsWith(/* @__PURE__ */ asEquivalence());
 var empty2 = () => [];
 var of = (a) => [a];
 var map3 = /* @__PURE__ */ dual(2, (self, f) => self.map(f));
+var filterMap = /* @__PURE__ */ dual(2, (self, f) => {
+  const as = fromIterable(self);
+  const out = [];
+  for (let i = 0;i < as.length; i++) {
+    const result = f(as[i], i);
+    if (isSuccess2(result)) {
+      out.push(result.success);
+    }
+  }
+  return out;
+});
 var filter = /* @__PURE__ */ dual(2, (self, predicate) => {
   const as = fromIterable(self);
   const out = [];
@@ -3475,6 +3487,7 @@ var flatMapEager = /* @__PURE__ */ dual(2, (self, f) => {
   }
   return flatMap2(self, f);
 });
+var flatten2 = (self) => flatMap2(self, identity);
 var map4 = /* @__PURE__ */ dual(2, (self, f) => new ContImpl(self, mapCont, f));
 var mapEager = /* @__PURE__ */ dual(2, (self, f) => effectIsExit(self) ? exitMap(self, f) : map4(self, f));
 var mapErrorEager = /* @__PURE__ */ dual(2, (self, f) => effectIsExit(self) ? exitMapError(self, f) : mapError(self, f));
@@ -5059,6 +5072,7 @@ var try_3 = try_2;
 var withFiber2 = withFiber;
 var fromResult2 = fromResult;
 var flatMap3 = flatMap2;
+var flatten3 = flatten2;
 var andThen2 = andThen;
 var tap2 = tap;
 var exit2 = exit;
@@ -7558,6 +7572,28 @@ function String3() {
 function Number4() {
   return transform(globalThis.Number);
 }
+function parseJson(options) {
+  return transformEffect((input, parseOptions) => try_3({
+    try: () => JSON.parse(input, options?.reviver),
+    catch: () => new InvalidValue({
+      expected: "a valid JSON string"
+    }, input, parseOptions)
+  }));
+}
+function stringifyJson(options) {
+  return transformEffect((input, parseOptions) => try_3({
+    try: () => {
+      const output = JSON.stringify(input, options?.replacer, options?.space);
+      if (output === undefined) {
+        throw new TypeError("Value cannot be represented as JSON");
+      }
+      return output;
+    },
+    catch: () => new InvalidValue({
+      expected: "a JSON-serializable value"
+    }, input, parseOptions)
+  }));
+}
 function encodeBase64() {
   return transform(encode);
 }
@@ -7567,6 +7603,15 @@ function decodeBase64() {
   }, input, options)));
 }
 
+// node_modules/effect/dist/internal/schema/content.js
+var ContentTypeId = /* @__PURE__ */ Symbol.for("~effect/Schema/content");
+function setContent(operation, content) {
+  Object.defineProperty(operation, ContentTypeId, {
+    value: content
+  });
+  return operation;
+}
+
 // node_modules/effect/dist/SchemaTransformation.js
 var TypeId18 = "~effect/SchemaTransformation/Transformation";
 var Transformation = class extends Class {
@@ -7664,6 +7709,12 @@ var urlFromString = /* @__PURE__ */ transformEffect2({
   encode: (url) => succeed6(url.href)
 });
 var uint8ArrayFromBase64String = /* @__PURE__ */ new Transformation(/* @__PURE__ */ decodeBase64(), /* @__PURE__ */ encodeBase64());
+function fromJsonString(options) {
+  return new Transformation(parseJson(options ?? {}), setContent(stringifyJson(options), {
+    mediaType: "application/json",
+    preserveSchema: options?.reviver === undefined && options?.replacer === undefined
+  }));
+}
 
 // node_modules/effect/dist/SchemaAST.js
 function makeGuard(tag) {
@@ -12355,6 +12406,7 @@ function Literal2(literal) {
   return out;
 }
 var Unknown2 = /* @__PURE__ */ make25(unknown);
+var Null2 = /* @__PURE__ */ make25(null_);
 var Undefined2 = /* @__PURE__ */ make25(undefined_2);
 var String5 = /* @__PURE__ */ make25(string2);
 var Number6 = /* @__PURE__ */ make25(number2);
@@ -12408,6 +12460,7 @@ function Literals(literals) {
     }
   });
 }
+var NullOr = /* @__PURE__ */ lambda((self) => Union2([self, Null2]));
 var UndefinedOr = /* @__PURE__ */ lambda((self) => Union2([self, Undefined2]));
 function decodeTo2(to, transformation) {
   return (from) => {
@@ -12485,6 +12538,45 @@ function isBase64(annotations) {
     ...annotations
   });
 }
+function makeIsGreaterThan(options) {
+  const gt = isGreaterThan(options.order);
+  const formatter = options.formatter ?? format;
+  return (exclusiveMinimum, annotations) => {
+    return makeFilter2((input) => gt(input, exclusiveMinimum), {
+      expected: `a value greater than ${formatter(exclusiveMinimum)}`,
+      arbitraryConstraint: {
+        order: options.order,
+        minimum: exclusiveMinimum,
+        exclusiveMinimum: true
+      },
+      ...options.annotate?.(exclusiveMinimum),
+      ...annotations
+    });
+  };
+}
+function encodeNumberPayload(number) {
+  if (!globalThis.Number.isFinite(number)) {
+    throw new globalThis.RangeError(`Expected a finite number, got ${format(number)}`);
+  }
+  return number;
+}
+var isGreaterThan2 = /* @__PURE__ */ makeIsGreaterThan({
+  order: Number2,
+  annotate: (exclusiveMinimum) => ({
+    representation: {
+      id: "effect/schema/isGreaterThan",
+      payload: {
+        exclusiveMinimum: encodeNumberPayload(exclusiveMinimum)
+      }
+    },
+    toJsonSchema: () => ({
+      exclusiveMinimum
+    }),
+    toCode: () => ({
+      runtime: `Schema.isGreaterThan(${format(exclusiveMinimum)})`
+    })
+  })
+});
 function isInt(annotations) {
   return makeFilter2((n) => globalThis.Number.isSafeInteger(n), {
     expected: "an integer",
@@ -12614,6 +12706,13 @@ var URL2 = /* @__PURE__ */ instanceOf(globalThis.URL, {
   expected: "URL",
   toCodecJson: () => link3()(URLString, urlFromString)
 });
+var URLFromString = /* @__PURE__ */ URLString.pipe(/* @__PURE__ */ decodeTo2(URL2, urlFromString));
+var JsonString = /* @__PURE__ */ String5.annotate({
+  expected: "a string that will be decoded as JSON"
+});
+function fromJsonString2(schema, options) {
+  return JsonString.pipe(decodeTo2(schema, fromJsonString(options)));
+}
 var File = /* @__PURE__ */ instanceOf(globalThis.File, {
   representation: {
     id: "effect/schema/File",
@@ -13649,7 +13748,7 @@ var Custom = (initialState, ...args) => {
   op.events = events;
   return op;
 };
-var Date4 = (options) => {
+var Date5 = (options) => {
   const opts = {
     initial: new globalThis.Date,
     dateMask: "YYYY-MM-DD HH:mm:ss",
@@ -18141,7 +18240,7 @@ var promptSingle = (single) => {
       })), commandLineArg);
     }
     case "Date":
-      return map6(run3(Date4({
+      return map6(run3(Date5({
         message
       })), (date) => commandLineArg(date.toISOString()));
     case "Finite":
@@ -18519,7 +18618,7 @@ var runWith2 = (command, config) => {
   }) => andThen2(showUserError(error, userMessage), fail7(error))), catchFilter2((e) => isQuitError(e) ? succeed2(e) : fail2(e), (_) => interrupt2));
 };
 // package.json
-var version = "0.0.3";
+var version = "0.0.5";
 // node_modules/effect/dist/http/HttpBody.js
 var TypeId35 = "~effect/http/HttpBody";
 var HttpBodyErrorTypeId = "~effect/http/HttpBody/HttpBodyError";
@@ -18804,6 +18903,7 @@ var make32 = (method) => (url, options) => modify(empty8, {
   url,
   ...options ?? undefined
 });
+var get4 = /* @__PURE__ */ make32("GET");
 var post = /* @__PURE__ */ make32("POST");
 var modify = /* @__PURE__ */ dual(2, (self, options) => {
   let result = self;
@@ -18880,14 +18980,6 @@ var getWebSource = (self) => self[WebSourceSymbol]?.();
 // node_modules/effect/dist/http/HttpClientResponse.js
 var TypeId39 = "~effect/http/HttpClientResponse";
 var fromWeb = (request, source) => new WebHttpClientResponse(request, source);
-var filterStatusOk = (self) => self.status >= 200 && self.status < 300 ? succeed6(self) : fail7(new HttpClientError({
-  reason: new StatusCodeError({
-    response: self,
-    request: self.request,
-    description: "non 2xx status code"
-  })
-}));
-
 class WebHttpClientResponse extends Class2 {
   [TypeId38];
   [TypeId39];
@@ -19073,7 +19165,6 @@ var addHeaderAttributes = (span, phase, headers, filter, redactedNames) => {
 var TypeId40 = "~effect/http/HttpClient";
 var HttpClient = /* @__PURE__ */ Service("effect/HttpClient");
 var transformResponse = /* @__PURE__ */ dual(2, (self, f) => makeWith2((request) => f(self.postprocess(request)), self.preprocess));
-var filterStatusOk2 = /* @__PURE__ */ transformResponse(/* @__PURE__ */ flatMap3(filterStatusOk));
 var makeWith2 = (postprocess, preprocess) => {
   const self = Object.create(Proto14);
   self.preprocess = preprocess;
@@ -19478,6 +19569,469 @@ var exports = fn2("Environment.exports")(function* exports() {
 `);
 });
 
+// src/deploy.ts
+var controlPlane = "https://api.convex.dev";
+var callbackMarker = "AFFECT_CONVEX_DEPLOY_CALLBACK";
+var callbackCommand = "bunx --no-install affect deploy --build";
+var deploymentNames = [
+  "CONVEX_DEPLOY_KEY",
+  "CONVEX_DEPLOYMENT_TOKEN",
+  "CONVEX_DEPLOYMENT",
+  "CONVEX_OVERRIDE_ACCESS_TOKEN",
+  "CONVEX_SELF_HOSTED_URL",
+  "CONVEX_SELF_HOSTED_ADMIN_KEY",
+  "CONVEX_AGENT_MODE",
+  "CONVEX_PROVISION_HOST"
+];
+var canonicalNames = ["VITE_CONVEX_URL", "VITE_CONVEX_SITE_URL"];
+var publicBuildNames = ["VITE_SITE_URL", "VITE_POSTHOG_HOST", "VITE_POSTHOG_KEY"];
+var hostNames = [
+  "CI",
+  "GITHUB_ACTIONS",
+  "VERCEL",
+  "VERCEL_TARGET_ENV",
+  "NOW_BUILDER",
+  "VERCEL_GIT_COMMIT_SHA",
+  "VERCEL_URL",
+  "VERCEL_BRANCH_URL",
+  "VERCEL_PROJECT_PRODUCTION_URL"
+];
+var optionalSystemNames = ["TMPDIR", "TMP", "TEMP", "LANG", "LC_ALL"];
+var proxyNames = [
+  "NODE_USE_ENV_PROXY",
+  "HTTP_PROXY",
+  "HTTPS_PROXY",
+  "ALL_PROXY",
+  "NO_PROXY",
+  "http_proxy",
+  "https_proxy",
+  "all_proxy",
+  "no_proxy"
+];
+var reservedSetting = /^(?:CONVEX_|DOTENV_|(?:[A-Z0-9]+_)*PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|VERCEL_|GITHUB_|NODE_|BUN_|AFFECT_|CI$|PATH$|HOME$|USERPROFILE$|PWD$|SHELL$|ENV$|TMPDIR$|(?:HTTPS?|ALL|NO)_PROXY$)/u;
+var failure = (cause) => new UserError({ cause });
+var empty9 = "";
+var Origin = URLFromString.check(makeFilter2((url) => url.protocol === "https:" && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === ""));
+var Id = Int.check(isGreaterThan2(0));
+var Slug = String5.check(isPattern2(/^[a-z0-9][a-z0-9_-]*$/u));
+var Identity = Struct({
+  project: Slug,
+  projectId: Id,
+  team: Slug,
+  teamId: Id
+});
+var Deployment = Struct({
+  deploymentType: Literals(["dev", "preview", "prod"]),
+  id: Id,
+  kind: Literal2("cloud"),
+  projectId: Id,
+  teamId: Id
+});
+var CanonicalUrls = Struct({
+  convexCloudUrl: Origin,
+  convexSiteUrl: Origin
+});
+var PreviewAuthorization = Struct({
+  adminKey: NonEmptyString,
+  deploymentName: NonEmptyString,
+  deploymentType: Literal2("preview"),
+  isDefault: Boolean3,
+  reference: NullOr(String5),
+  url: Origin
+});
+var Declaration2 = Record(String5, Struct({
+  isConvexValidator: Literal2(true),
+  isOptional: Literals(["required", "optional"])
+}));
+var RootManifest = Struct({
+  dependencies: optional2(Record(String5, String5)),
+  devDependencies: optional2(Record(String5, String5)),
+  scripts: Record(String5, String5),
+  workspaces: ArraySchema(String5)
+});
+var WebManifest = Struct({
+  dependencies: optional2(Record(String5, String5)),
+  devDependencies: optional2(Record(String5, String5)),
+  name: Literal2("@affect/web"),
+  scripts: Record(String5, String5)
+});
+var inheritedNames = [
+  "PATH",
+  "CI",
+  "GITHUB_ACTIONS",
+  "VERCEL_ENV",
+  "VERCEL_GIT_COMMIT_REF",
+  "NODE_OPTIONS",
+  "BUN_OPTIONS",
+  ...deploymentNames,
+  ...canonicalNames,
+  ...publicBuildNames,
+  ...hostNames,
+  ...optionalSystemNames,
+  ...proxyNames
+];
+var readInheritedEnvironment = fnUntraced2(function* readInheritedEnvironment() {
+  const inherited = {};
+  for (const name of inheritedNames) {
+    inherited[name] = yield* String6(name).pipe(withDefault3(empty9));
+  }
+  return inherited;
+});
+var httpRequest = fnUntraced2(function* httpRequest(url, authorization, body) {
+  const client = yield* HttpClient;
+  const request = setHeader(body === undefined ? get4(url) : post(url), "Authorization", authorization);
+  const outgoing = body === undefined ? request : yield* bodyJson(request, body);
+  const response = yield* client.execute(outgoing);
+  if (response.status !== 200) {
+    return yield* failure("Convex deployment verification failed.");
+  }
+  return response;
+}, mapError2(() => failure("Convex deployment verification failed.")));
+var json2 = (schema, response) => response.json.pipe(flatMap3(decodeEffect2(schema)), mapError2(() => failure("Convex deployment returned invalid metadata.")));
+var validateDeploymentControls = fnUntraced2(function* validateDeploymentControls(values, inherited) {
+  for (const name of deploymentNames) {
+    const configured = values[name] ?? empty9;
+    const ambient = inherited[name] ?? empty9;
+    if (name === "CONVEX_DEPLOY_KEY") {
+      continue;
+    }
+    if (name === "CONVEX_PROVISION_HOST") {
+      if (configured !== empty9 && configured !== controlPlane || ambient !== empty9 && ambient !== controlPlane) {
+        return yield* failure("Convex provider host must be the standard Convex control plane.");
+      }
+      continue;
+    }
+    if (configured !== empty9 || ambient !== empty9) {
+      return yield* failure("Conflicting Convex deployment authentication or target settings are not allowed.");
+    }
+  }
+  return yield* void_3;
+});
+var validateProfileKey = fnUntraced2(function* validateProfileKey(target, branch, deployKey, values, inherited) {
+  const matchingPrefix = target === "preview" ? "preview:" : "prod:";
+  if (!deployKey.startsWith(matchingPrefix)) {
+    return yield* failure("Encrypted project file must contain a Convex deploy key matching VERCEL_ENV.");
+  }
+  if (target === "preview") {
+    if (!/^[A-Za-z0-9][A-Za-z0-9_./-]*$/u.test(branch)) {
+      return yield* failure("Preview deployment requires a valid branch name.");
+    }
+    const parts = /^preview:(?<team>[a-z0-9][a-z0-9_-]*):(?<project>[a-z0-9][a-z0-9_-]*)\|(?<secret>.+)$/u.exec(deployKey);
+    const groups = parts?.groups;
+    if (groups?.["team"] === undefined || groups["project"] === undefined || groups["secret"] === undefined) {
+      return yield* failure("Encrypted project file must contain a valid preview-scoped Convex deploy key.");
+    }
+    return {
+      branch,
+      deployKey,
+      inherited,
+      projectSlug: groups["project"],
+      target,
+      teamSlug: groups["team"],
+      values
+    };
+  }
+  if (!/^prod:[a-z0-9][a-z0-9-]*\|.+$/u.test(deployKey)) {
+    return yield* failure("Encrypted project file must contain a valid production-scoped Convex deploy key.");
+  }
+  return { branch, deployKey, inherited, target, values };
+});
+var profile = fn2("Deploy.profile")(function* profile() {
+  const { target, values } = yield* load();
+  if (target !== "preview" && target !== "production") {
+    return yield* failure("Deploy requires VERCEL_ENV=preview or production.");
+  }
+  const inherited = yield* readInheritedEnvironment();
+  const inheritedKey = inherited["CONVEX_DEPLOY_KEY"] ?? empty9;
+  const deployKey = values["CONVEX_DEPLOY_KEY"] ?? empty9;
+  if (inheritedKey !== empty9 && inheritedKey !== deployKey) {
+    return yield* failure("CONVEX_DEPLOY_KEY conflicts with the selected encrypted project file.");
+  }
+  yield* validateDeploymentControls(values, inherited);
+  return yield* validateProfileKey(target, inherited["VERCEL_GIT_COMMIT_REF"] ?? empty9, deployKey, values, inherited);
+});
+var readDeclaration = fn2("Deploy.readDeclaration")(function* readDeclaration(root) {
+  const path = yield* Path;
+  const declarationPath = path.join(root, "convex", "env.config.ts");
+  const imported = yield* try_3({
+    catch: () => failure("Cannot load the declaration-only convex/env.config.ts."),
+    try: () => {
+      const module = import.meta.require(declarationPath);
+      return module;
+    }
+  });
+  const decoded = yield* decodeUnknownEffect2(Struct({ default: Declaration2 }))(imported).pipe(mapError2(() => failure("Cannot load a valid declaration-only Convex environment definition.")));
+  const keys2 = keys(decoded.default);
+  yield* decodeEffect2(ArraySchema(String5.check(makeFilter2((name) => !reservedSetting.test(name)))))(keys2).pipe(mapError2(() => failure("Server declaration contains a credential, control or client-public name.")));
+  return decoded.default;
+});
+var readManifest = fn2("Deploy.readManifest")(function* readManifest(root, relativePath, schema) {
+  const fs = yield* FileSystem;
+  const path = yield* Path;
+  const filePath = path.join(root, relativePath);
+  const content = yield* fs.readFileString(filePath).pipe(mapError2(() => failure("The Affect TanStack workspace build contract is unavailable.")));
+  const value = yield* decodeEffect2(fromJsonString2(schema))(content).pipe(mapError2(() => failure("The Affect TanStack workspace build contract is invalid.")));
+  return value;
+});
+var preflight = fn2("Deploy.preflight")(function* preflight() {
+  const path = yield* Path;
+  const root = path.resolve(".");
+  const [rootManifest, webManifest] = yield* all2([
+    readManifest(root, "package.json", RootManifest),
+    readManifest(root, "apps/web/package.json", WebManifest)
+  ]);
+  const dependencies = { ...rootManifest.dependencies, ...rootManifest.devDependencies };
+  const webDependencies = { ...webManifest.dependencies, ...webManifest.devDependencies };
+  if (!contains("apps/*")(rootManifest.workspaces) || rootManifest.scripts["build"] !== "bun run --filter @affect/web build" || dependencies["vite"] === undefined || dependencies["convex"] === undefined || webManifest.scripts["build"] !== "vite build" || webDependencies["@tanstack/react-start"] === undefined || webDependencies["vite"] === undefined) {
+    return yield* failure("This CLI requires the Affect TanStack workspace build contract.");
+  }
+  const declaration = yield* readDeclaration(root);
+  return { declaration, root };
+});
+var selectedBackendSettings = (values, declaration) => map3(filter(toEntries(declaration), ([name]) => has(values, name)), ([name]) => ({ name, value: values[name] ?? empty9 }));
+var validateRequiredSettings = (values, declaration) => {
+  const required = filter(toEntries(declaration), ([name, validator]) => validator.isOptional === "required" && !has(values, name));
+  if (required.length === 0) {
+    return void_3;
+  }
+  const missing = [];
+  for (const [name] of required) {
+    missing.push(name);
+  }
+  return failure(`Missing required server settings: ${join(missing, ", ")}.`);
+};
+var childProfileCollision = (values, required) => {
+  for (const name of required) {
+    if (has(values, name)) {
+      return true;
+    }
+  }
+  return false;
+};
+var copyDefined = (source, names, values, into) => {
+  for (const name of names) {
+    if (!has(values, name) && source[name] !== empty9) {
+      into[name] = source[name] ?? empty9;
+    }
+  }
+};
+var temporaryHome = fnUntraced2(function* temporaryHome(prepareMessage, cleanupMessage) {
+  const fileSystem = yield* FileSystem;
+  return yield* acquireRelease2(fileSystem.makeTempDirectory({ prefix: "affect-cli-home-" }).pipe(mapError2(() => failure(prepareMessage))), (directory) => fileSystem.remove(directory, { force: true, recursive: true }).pipe(mapError2(() => failure(cleanupMessage)), ignore2));
+});
+var verifiedDeployment = fn2("Deploy.verifyDeployment")(function* verifiedDeployment(selected, callbackCloud, callbackSite) {
+  const key = selected.deployKey;
+  if (selected.target === "production") {
+    const endpoint = yield* json2(Origin, yield* httpRequest(`${controlPlane}/api/deployment/url_for_key`, `Bearer ${key}`, {
+      deployKey: key
+    }));
+    const deploymentAuthorization = `Convex ${key}`;
+    const deploymentName = key.slice("prod:".length).split("|", 1)[0] ?? empty9;
+    const identity = yield* json2(Identity, yield* httpRequest(`${controlPlane}/api/deployment/team_and_project_for_key`, `Bearer ${key}`, { deployKey: key }));
+    const info = yield* json2(Deployment, yield* httpRequest(`${endpoint.origin}/api/v1/deployment_info`, deploymentAuthorization));
+    if (info.deploymentType !== "prod" || info.teamId !== identity.teamId || info.projectId !== identity.projectId) {
+      return yield* failure("Production deploy key and Convex deployment metadata do not match.");
+    }
+    const canonical = yield* json2(CanonicalUrls, yield* httpRequest(`${endpoint.origin}/api/v1/get_canonical_urls`, deploymentAuthorization));
+    if (canonical.convexCloudUrl.origin !== endpoint.origin || canonical.convexCloudUrl.origin !== callbackCloud.origin || canonical.convexSiteUrl.origin !== callbackSite.origin) {
+      return yield* failure("Native Convex URLs do not match the selected production deployment.");
+    }
+    return {
+      adminKey: key,
+      cloud: canonical.convexCloudUrl.origin,
+      deploymentName,
+      deploymentType: "prod",
+      identity,
+      site: canonical.convexSiteUrl.origin,
+      url: endpoint.origin
+    };
+  }
+  const teamSlugFromKey = selected.teamSlug ?? empty9;
+  const projectSlugFromKey = selected.projectSlug ?? empty9;
+  const authorization = yield* json2(PreviewAuthorization, yield* httpRequest(`${controlPlane}/api/deployment/authorize_preview`, `Bearer ${key}`, {
+    previewName: selected.branch,
+    projectSelection: {
+      kind: "teamAndProjectSlugs",
+      projectSlug: projectSlugFromKey,
+      teamSlug: teamSlugFromKey
+    }
+  }));
+  const endpoint = authorization.url;
+  const deploymentAuthorization = `Convex ${authorization.adminKey}`;
+  const { deploymentName } = authorization;
+  const info = yield* json2(Deployment, yield* httpRequest(`${endpoint.origin}/api/v1/deployment_info`, deploymentAuthorization));
+  if (authorization.deploymentType !== "preview" || info.deploymentType !== "preview") {
+    return yield* failure("Preview authorization and Convex deployment metadata do not match.");
+  }
+  const canonical = yield* json2(CanonicalUrls, yield* httpRequest(`${endpoint.origin}/api/v1/get_canonical_urls`, deploymentAuthorization));
+  if (canonical.convexCloudUrl.origin !== endpoint.origin || canonical.convexCloudUrl.origin !== callbackCloud.origin || canonical.convexSiteUrl.origin !== callbackSite.origin) {
+    return yield* failure("Native Convex URLs do not match the selected preview deployment.");
+  }
+  return {
+    adminKey: authorization.adminKey,
+    cloud: canonical.convexCloudUrl.origin,
+    deploymentName,
+    deploymentType: "preview",
+    identity: {
+      project: projectSlugFromKey,
+      projectId: info.projectId,
+      team: teamSlugFromKey,
+      teamId: info.teamId
+    },
+    site: canonical.convexSiteUrl.origin,
+    url: endpoint.origin
+  };
+});
+var buildEnvironment = (selected, values, verified, scratchHome) => {
+  const child = {};
+  copyDefined(selected.inherited, ["PATH", ...optionalSystemNames], values, child);
+  child[process.platform === "win32" ? "USERPROFILE" : "HOME"] = scratchHome;
+  child["VERCEL_ENV"] = selected.target;
+  if (selected.target === "preview") {
+    child["VERCEL_GIT_COMMIT_REF"] = selected.branch;
+  }
+  copyDefined(selected.inherited, hostNames, values, child);
+  for (const name of canonicalNames) {
+    child[name] = name === "VITE_CONVEX_URL" ? verified.cloud : verified.site;
+  }
+  for (const name of publicBuildNames) {
+    const profileValue = values[name];
+    const inheritedValue = selected.inherited[name] ?? empty9;
+    if (profileValue !== undefined) {
+      child[name] = profileValue;
+    } else if (inheritedValue !== empty9) {
+      child[name] = inheritedValue;
+    }
+  }
+  return child;
+};
+var syncSettings = fn2("Deploy.syncSettings")(function* syncSettings(verified, settings) {
+  if (settings.length === 0) {
+    return yield* void_3;
+  }
+  const client = yield* HttpClient;
+  const request = yield* bodyJson(setHeader(post(`${verified.url}/api/v1/update_environment_variables`), "Authorization", `Convex ${verified.adminKey}`), { changes: settings });
+  const response = yield* client.execute(request);
+  if (response.status !== 200) {
+    return yield* failure("Could not synchronize Convex environment variables.");
+  }
+  return yield* void_3;
+}, mapError2(() => failure("Could not synchronize Convex environment variables.")));
+var runBuildCallback = fn2("Deploy.runBuildCallback")(function* runBuildCallback() {
+  const callbackMode = yield* String6(callbackMarker).pipe(withDefault3(empty9));
+  if (callbackMode !== "1") {
+    return yield* failure("The Convex build callback can only run through affect deploy.");
+  }
+  const selected = yield* profile();
+  const { declaration, root } = yield* preflight();
+  yield* validateRequiredSettings(selected.values, declaration);
+  const cloudText = yield* NonEmptyString2("VITE_CONVEX_URL").pipe(mapError2(() => failure("Native Convex did not inject the canonical cloud URL.")));
+  const siteText = yield* NonEmptyString2("VITE_CONVEX_SITE_URL").pipe(mapError2(() => failure("Native Convex did not inject the canonical site URL.")));
+  const cloud = yield* decodeEffect2(Origin)(cloudText).pipe(mapError2(() => failure("Native Convex injected an invalid cloud URL.")));
+  const site = yield* decodeEffect2(Origin)(siteText).pipe(mapError2(() => failure("Native Convex injected an invalid site URL.")));
+  const verified = yield* verifiedDeployment(selected, cloud, site).pipe(provide3(layer11), provideService2(RequestInit, { redirect: "error" }));
+  const settings = selectedBackendSettings(selected.values, declaration);
+  yield* syncSettings(verified, settings).pipe(provide3(layer11), provideService2(RequestInit, { redirect: "error" }));
+  yield* error(`Convex target: ${verified.identity.team}/${verified.identity.project}; ${verified.deploymentType} ${verified.deploymentName}.`);
+  const home = yield* temporaryHome("Could not prepare an isolated build environment.", "Could not clean the isolated build environment.");
+  const env = buildEnvironment(selected, selected.values, verified, home);
+  const child = yield* make18("bun", ["run", "build"], {
+    cwd: root,
+    env,
+    extendEnv: false,
+    stderr: "inherit",
+    stdin: "inherit",
+    stdout: "inherit"
+  });
+  const status = yield* child.exitCode;
+  if (status !== 0) {
+    return yield* failure(`bun run build exited with status ${status}.`);
+  }
+  return yield* void_3;
+});
+var nativeEnvironment = (selected, values, privateKey, home) => {
+  const env = {};
+  for (const name of [
+    ...hostNames,
+    ...optionalSystemNames,
+    ...proxyNames,
+    "NODE_OPTIONS",
+    "BUN_OPTIONS"
+  ]) {
+    env[name] = empty9;
+  }
+  copyDefined(selected.inherited, ["PATH", ...optionalSystemNames, ...hostNames, ...proxyNames], values, env);
+  env["VERCEL_ENV"] = selected.target;
+  if (selected.target === "preview") {
+    env["VERCEL_GIT_COMMIT_REF"] = selected.branch;
+  }
+  env[process.platform === "win32" ? "USERPROFILE" : "HOME"] = home;
+  env["CONVEX_PROVISION_HOST"] = controlPlane;
+  env["CONVEX_DEPLOY_KEY"] = selected.deployKey;
+  env["DOTENV_PRIVATE_KEY"] = privateKey;
+  env[callbackMarker] = "1";
+  for (const name of deploymentNames) {
+    if (name !== "CONVEX_DEPLOY_KEY" && name !== "CONVEX_PROVISION_HOST") {
+      env[name] = empty9;
+    }
+  }
+  for (const name of canonicalNames) {
+    env[name] = empty9;
+  }
+  for (const name of publicBuildNames) {
+    env[name] = values[name] ?? selected.inherited[name] ?? empty9;
+  }
+  return env;
+};
+var deployNative = fn2("Deploy.native")(function* deployNative(selected, values, root) {
+  const privateKey = yield* NonEmptyString2("DOTENV_PRIVATE_KEY").pipe(mapError2(() => failure("Set the matching DOTENV_PRIVATE_KEY for the selected profile.")));
+  const home = yield* temporaryHome("Could not prepare an isolated Convex configuration home.", "Could not clean the isolated Convex configuration home.");
+  const env = nativeEnvironment(selected, values, privateKey, home);
+  const args = [
+    "--no-install",
+    "convex",
+    "deploy",
+    "--cmd-url-env-var-name",
+    "VITE_CONVEX_URL",
+    ...selected.target === "preview" ? ["--preview-name", selected.branch] : [],
+    "--cmd",
+    callbackCommand
+  ];
+  const child = yield* make18("bunx", args, {
+    cwd: root,
+    env,
+    extendEnv: false,
+    stderr: "inherit",
+    stdin: "inherit",
+    stdout: "inherit"
+  });
+  const status = yield* child.exitCode;
+  if (status !== 0) {
+    return yield* failure(`Convex deploy exited with status ${status}.`);
+  }
+  return yield* void_3;
+});
+var deploy = fn2("Deploy.run")(function* deploy(build) {
+  if (build) {
+    return yield* runBuildCallback();
+  }
+  const selected = yield* profile();
+  const { declaration } = yield* preflight();
+  yield* validateRequiredSettings(selected.values, declaration);
+  const requiredCollisions = [
+    "PATH",
+    "VERCEL_ENV",
+    ...selected.target === "preview" ? ["VERCEL_GIT_COMMIT_REF"] : []
+  ];
+  if (childProfileCollision(selected.values, requiredCollisions)) {
+    return yield* failure("Encrypted profile conflicts with required deployment environment settings.");
+  }
+  const path = yield* Path;
+  const root = path.resolve(".");
+  yield* error(`Convex target: ${selected.target}${selected.target === "preview" ? ` (${selected.branch})` : ""}; selected by env/${selected.target}/.env.`);
+  return yield* deployNative(selected, selected.values, root);
+}, scoped2);
+
 // src/process.ts
 var run6 = fn2("Process.run")(function* run(command) {
   const child = yield* command;
@@ -19498,76 +20052,6 @@ var convex = (args, env, input) => run6(make18("bunx", ["--no-install", "convex"
   stdout: "inherit"
 }));
 
-// src/deploy.ts
-var convexManagedEnvironmentNames = [
-  "CONVEX_DEPLOY_KEY",
-  "CONVEX_DEPLOYMENT_TOKEN",
-  "CONVEX_DEPLOYMENT",
-  "CONVEX_SELF_HOSTED_URL",
-  "CONVEX_SELF_HOSTED_ADMIN_KEY",
-  "CONVEX_URL",
-  "PUBLIC_CONVEX_URL",
-  "NEXT_PUBLIC_CONVEX_URL",
-  "VITE_CONVEX_URL",
-  "REACT_APP_CONVEX_URL",
-  "EXPO_PUBLIC_CONVEX_URL",
-  "CONVEX_SITE_URL",
-  "PUBLIC_CONVEX_SITE_URL",
-  "NEXT_PUBLIC_CONVEX_SITE_URL",
-  "VITE_CONVEX_SITE_URL",
-  "REACT_APP_CONVEX_SITE_URL",
-  "EXPO_PUBLIC_CONVEX_SITE_URL"
-];
-var deploy = fn2("Deploy.run")(function* deploy(build) {
-  const environment = yield* load();
-  const { target, values, file } = environment;
-  if (target !== "preview" && target !== "production") {
-    return yield* new UserError({
-      cause: "Deploy requires VERCEL_ENV=preview or production."
-    });
-  }
-  const branch = yield* String6("VERCEL_GIT_COMMIT_REF").pipe(withDefault3(""));
-  if (target === "preview" && !branch) {
-    return yield* new UserError({ cause: "Preview deployment requires a branch name." });
-  }
-  const prefix = target === "preview" ? "preview:" : "prod:";
-  const deployKey = values["CONVEX_DEPLOY_KEY"] ?? "";
-  if (!deployKey.startsWith(prefix)) {
-    return yield* new UserError({
-      cause: "Encrypted project file must contain a Convex deploy key matching VERCEL_ENV."
-    });
-  }
-  yield* error(`Convex target: ${target}${target === "preview" ? ` (${branch})` : ""}; selected by env/${target}/.env.`);
-  if (build) {
-    const cloud = yield* NonEmptyString2("NEXT_PUBLIC_CONVEX_URL");
-    const site = yield* NonEmptyString2("NEXT_PUBLIC_CONVEX_SITE_URL");
-    const changes = map3(filter(toEntries(values), ([name]) => !contains(name)(convexManagedEnvironmentNames)), ([name, value]) => ({ name, value }));
-    if (changes.length > 0) {
-      yield* gen2(function* syncEnvironmentVariables() {
-        const client = yield* HttpClient;
-        const request = yield* bodyJson(setHeader(post(`${cloud}/api/v1/update_environment_variables`), "Authorization", `Convex ${deployKey}`), { changes });
-        yield* filterStatusOk2(client).execute(request).pipe(asVoid2);
-      }).pipe(provide3(layer11), mapError2(() => new UserError({
-        cause: "Could not synchronize Convex environment variables."
-      })));
-    }
-    return yield* run6(make18("bun", ["run", "build"], {
-      env: { ...values, NEXT_PUBLIC_CONVEX_SITE_URL: site, NEXT_PUBLIC_CONVEX_URL: cloud },
-      extendEnv: true,
-      stderr: "inherit",
-      stdout: "inherit"
-    })).pipe(asVoid2);
-  }
-  const fs = yield* FileSystem;
-  yield* fs.copyFile(file, "apps/web/.env.production");
-  return yield* convex([
-    "deploy",
-    ...target === "preview" ? ["--preview-name", branch] : [],
-    "--cmd",
-    "bunx --no-install affect deploy --build"
-  ], values).pipe(asVoid2);
-});
-
 // src/dotenv.ts
 var dotenvx = fn2("Dotenvx.run")(function* dotenvx(args, capture) {
   const path = yield* Path;
@@ -19645,15 +20129,117 @@ var setup = fn2("Setup.run")(function* setup() {
   return yield* log("Local Convex setup complete.");
 });
 
+// src/sync-dev.ts
+var failure2 = (cause) => new UserError({ cause });
+var reserved = /^(?:CONVEX_|DOTENV_|(?:[A-Z0-9]+_)*PUBLIC_|VITE_|REACT_APP_|EXPO_PUBLIC_|VERCEL_|GITHUB_|NODE_|BUN_|AFFECT_|CI$|PATH$|HOME$|PWD$|SHELL$|ENV$|TMPDIR$|(?:HTTPS?|ALL|NO)_PROXY$)/u;
+var SettingName = String5.check(makeFilter2((name) => !reserved.test(name)));
+var Declaration3 = Record(String5, Struct({
+  isConvexValidator: Literal2(true),
+  isOptional: Literals(["required", "optional"])
+}));
+var Origin2 = URLFromString.check(makeFilter2((url) => url.protocol === "https:" && url.username === "" && url.password === "" && url.pathname === "/" && url.search === "" && url.hash === ""));
+var Profile = Struct({
+  CONVEX_DEPLOY_KEY: String5.check(isPattern2(/^dev:[a-z0-9-]+\|.+$/u)),
+  VITE_CONVEX_SITE_URL: Origin2,
+  VITE_CONVEX_URL: Origin2
+});
+var Slug2 = String5.check(isPattern2(/^[a-z0-9][a-z0-9_-]*$/u));
+var Id2 = Int.check(isGreaterThan2(0));
+var Identity2 = Struct({ project: Slug2, projectId: Id2, team: Slug2, teamId: Id2 });
+var Deployment2 = Struct({
+  deploymentType: Literal2("dev"),
+  id: Id2,
+  kind: Literal2("cloud"),
+  projectId: Id2,
+  teamId: Id2
+});
+var CanonicalUrls2 = Struct({ convexCloudUrl: Origin2, convexSiteUrl: Origin2 });
+var Existing = Struct({
+  environmentVariables: Record(String5, String5)
+});
+var request = fn2("DevelopmentEnv.request")(function* request(url, authorization, body) {
+  const client = yield* HttpClient;
+  const base = setHeader(body === undefined ? get4(url) : post(url), "Authorization", authorization);
+  const outgoing = body === undefined ? base : yield* bodyJson(base, body);
+  const response = yield* client.execute(outgoing);
+  if (response.status !== 200) {
+    return yield* failure2("Development environment request failed.");
+  }
+  return response;
+}, mapError2(() => failure2("Development environment request failed.")));
+var json3 = (schema, response) => response.json.pipe(flatMap3(decodeUnknownEffect2(schema)), mapError2(() => failure2("Invalid development deployment metadata.")));
+var syncDev = fn2("DevelopmentEnv.sync")(function* syncDev(force) {
+  const path = yield* Path;
+  const fs = yield* FileSystem;
+  const file = path.resolve("env", "development", ".env");
+  if (!(yield* fs.exists(file))) {
+    return yield* failure2("Missing env/development/.env.");
+  }
+  yield* NonEmptyString2("DOTENV_PRIVATE_KEY").pipe(mapError2(() => failure2("Set the matching development DOTENV_PRIVATE_KEY.")));
+  const values = yield* read2(file);
+  const profile = yield* decodeUnknownEffect2(Profile)(values).pipe(mapError2(() => failure2("Development profile requires a dev-scoped key and HTTPS Convex origins.")));
+  const name = profile.CONVEX_DEPLOY_KEY.split("|")[0]?.slice(4);
+  if ((values["CONVEX_DEPLOYMENT"] ?? "") !== "" && values["CONVEX_DEPLOYMENT"] !== `dev:${name}`) {
+    return yield* failure2("CONVEX_DEPLOYMENT does not match the development key.");
+  }
+  const declarationModule = yield* try_3({
+    catch: () => failure2("Cannot load the declaration-only convex/env.config.ts."),
+    try: () => decodeUnknownEffect2(Struct({ default: Declaration3 }))(import.meta.require(path.resolve("convex", "env.config.ts")))
+  }).pipe(flatten3, mapError2(() => failure2("Cannot load a valid declaration-only convex/env.config.ts with Convex validators.")));
+  const declaration = declarationModule.default;
+  yield* decodeEffect2(ArraySchema(SettingName))(keys(declaration)).pipe(mapError2(() => failure2("Server declaration contains a credential, control or client-public name.")));
+  const entries = toEntries(declaration);
+  const missing = filter(entries, ([key, validator]) => validator.isOptional === "required" && !has(values, key));
+  if (missing.length > 0) {
+    return yield* failure2(`Missing required server settings: ${join(map3(missing, ([key]) => key), ", ")}.`);
+  }
+  const selected = filterMap(entries, ([key]) => {
+    const value = has(values, key) ? values[key] : undefined;
+    return value === undefined ? failVoid : succeed2({ name: key, value });
+  });
+  const key = profile.CONVEX_DEPLOY_KEY;
+  const bearer = `Bearer ${key}`;
+  const lookup = { deployKey: key };
+  const cloud = yield* json3(Origin2, yield* request("https://api.convex.dev/api/deployment/url_for_key", bearer, lookup));
+  if (cloud.origin !== profile.VITE_CONVEX_URL.origin) {
+    return yield* failure2("Development key and public Convex URL do not match.");
+  }
+  const identity = yield* json3(Identity2, yield* request("https://api.convex.dev/api/deployment/team_and_project_for_key", bearer, lookup));
+  const authorization = `Convex ${key}`;
+  const deployment = yield* json3(Deployment2, yield* request(`${cloud.origin}/api/v1/deployment_info`, authorization));
+  if (deployment.teamId !== identity.teamId || deployment.projectId !== identity.projectId) {
+    return yield* failure2("Development deployment identity does not match the key.");
+  }
+  const urls = yield* json3(CanonicalUrls2, yield* request(`${cloud.origin}/api/v1/get_canonical_urls`, authorization));
+  if (urls.convexCloudUrl.origin !== cloud.origin || urls.convexSiteUrl.origin !== profile.VITE_CONVEX_SITE_URL.origin) {
+    return yield* failure2("Development canonical Convex URLs do not match the profile.");
+  }
+  yield* error(`Convex target: ${identity.team}/${identity.project}; development ${name} (ID ${deployment.id}).`);
+  const existing = yield* json3(Existing, yield* request(`${cloud.origin}/api/v1/list_environment_variables`, authorization));
+  const changed = filter(selected, (entry) => !has(existing.environmentVariables, entry.name) || existing.environmentVariables[entry.name] !== entry.value);
+  const conflicts = filter(changed, (entry) => has(existing.environmentVariables, entry.name));
+  if (!force && conflicts.length > 0) {
+    return yield* failure2(`Existing settings differ: ${join(map3(conflicts, (entry) => entry.name), ", ")}. Use --force to overwrite them.`);
+  }
+  if (changed.length > 0) {
+    yield* request(`${cloud.origin}/api/v1/update_environment_variables`, authorization, {
+      changes: changed
+    });
+  }
+  return yield* log(`Development settings: ${changed.length - conflicts.length} added, ${conflicts.length} updated, ${selected.length - changed.length} unchanged.`);
+}, provide3(layer11), provideService2(RequestInit, { redirect: "error" }));
+
 // src/index.ts
-var program = make30("affect").pipe(withDescription3("Environment and deployment commands for Affect applications."), withSubcommands([
-  make30("env", {}, () => exports().pipe(flatMap3(log))).pipe(withDescription3("Print shell exports for the selected encrypted environment.")),
+var program = make30("affect").pipe(withDescription3("Environment and native deployment commands for Affect applications."), withSubcommands([
+  make30("env", {}, () => exports().pipe(flatMap3(log))).pipe(withDescription3("Print shell exports for the selected encrypted environment."), withSubcommands([
+    make30("sync-dev", { force: Boolean6("force").pipe(withDefault5(false)) }, ({ force }) => syncDev(force)).pipe(withDescription3("Sync declared server settings to the verified hosted development backend; --force overwrites conflicts. No deployment."))
+  ])),
   make30("run", {
     command: String10("command"),
     params: String10("args").pipe(variadic2())
   }, ({ command, params }) => run7(command, params)).pipe(withDescription3("Run a command with the selected encrypted environment.")),
   make30("dotenvx", { args: String10("args").pipe(variadic2()) }, ({ args }) => dotenvx(args, false)).pipe(withDescription3("Run the bundled dotenvx CLI; pass its flags after --.")),
   make30("setup", {}, setup).pipe(withDescription3("Initialize or retry an anonymous local Convex backend.")),
-  make30("deploy", { build: Boolean6("build").pipe(withDefault5(false)) }, ({ build }) => deploy(build)).pipe(withDescription3("Deploy the selected Vercel preview or production environment."))
+  make30("deploy", { build: Boolean6("build").pipe(withDefault5(false)) }, ({ build }) => deploy(build)).pipe(withDescription3("Run native Convex deploy and the TanStack build for the selected Vercel target; does not publish frontend output. --build is the internal callback."))
 ]), run5({ version }), provide3(layer10), provideService2(LogToStderr2, true));
 runMain2(program);

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "affect-cli",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "Affect command-line interface",
-  "homepage": "https://github.com/ludicroushq/affect-cli#readme",
+  "homepage": "https://github.com/nahtnam/affect-cli#readme",
   "bugs": {
-    "url": "https://github.com/ludicroushq/affect-cli/issues"
+    "url": "https://github.com/nahtnam/affect-cli/issues"
   },
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/ludicroushq/affect-cli.git"
+    "url": "git+https://github.com/nahtnam/affect-cli.git"
   },
   "bin": {
     "affect": "dist/index.js"